The IP Login extension for Joomla generates persistent URL login keys with a non‑cryptographic random generator that provides insufficient entropy, making the tokens predictable and susceptible to guess or brute‑force attacks; an attacker who successfully obtains a valid key can log in without providing credentials, thereby bypassing authentication and potentially accessing restricted content.

All installations of the IP Login extension from regularlabs.com on Joomla sites are vulnerable; no specific version information is provided so all current and past versions should be examined and updated accordingly.

The EPSS score of less than 1% indicates that exploitation of this vulnerability is presently unlikely and may remain rare, while the vulnerability is not listed in the CISA KEV catalog; however, the weakness still permits an attacker to obtain access if they discover or brute‑force a login key. Based on the description, it is inferred that the attack method involves brute‑forcing or guessing the predictable URL key, which would grant authentication bypass. This makes the risk moderate in environments where the extension is widely exposed. The publicly available CVSS score of 9.1 highlights a critical severity, underscoring the potential impact if an attacker obtains a valid login key.